Overview
overview
6Static
static
3Roblox Acc...er.exe
windows11-21h2-x64
6Roblox Acc...er.exe
windows11-21h2-x64
3Roblox Acc...um.dll
windows11-21h2-x64
3Roblox Acc...re.dll
windows11-21h2-x64
3Roblox Acc...ss.exe
windows11-21h2-x64
3Roblox Acc...me.dll
windows11-21h2-x64
3Roblox Acc...rp.dll
windows11-21h2-x64
1Roblox Acc...lf.dll
windows11-21h2-x64
3Roblox Acc...47.dll
windows11-21h2-x64
3Roblox Acc...GL.dll
windows11-21h2-x64
3Roblox Acc...v2.dll
windows11-21h2-x64
3Roblox Acc...ef.dll
windows11-21h2-x64
3Roblox Acc...er.dll
windows11-21h2-x64
3Roblox Acc...-1.dll
windows11-21h2-x64
3Analysis
-
max time kernel
97s -
max time network
142s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/08/2024, 14:48
Static task
static1
Behavioral task
behavioral1
Sample
Roblox Account Manager/RBX Alt Manager.exe
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
Roblox Account Manager/Roblox Account Manager.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
Roblox Account Manager/libsodium.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
Roblox Account Manager/x86/CefSharp.BrowserSubprocess.Core.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Roblox Account Manager/x86/CefSharp.BrowserSubprocess.exe
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
Roblox Account Manager/x86/CefSharp.Core.Runtime.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
Roblox Account Manager/x86/CefSharp.dll
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
Roblox Account Manager/x86/chrome_elf.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
Roblox Account Manager/x86/d3dcompiler_47.dll
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
Roblox Account Manager/x86/libEGL.dll
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
Roblox Account Manager/x86/libGLESv2.dll
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
Roblox Account Manager/x86/libcef.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
Roblox Account Manager/x86/vk_swiftshader.dll
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
Roblox Account Manager/x86/vulkan-1.dll
Resource
win11-20240802-en
General
-
Target
Roblox Account Manager/libsodium.dll
-
Size
477KB
-
MD5
4f6426e3626d5d46fb19c13043cb84de
-
SHA1
9dfa32f957c19c843a568b57d555d6d5cbc61579
-
SHA256
7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba
-
SHA512
7a83adf2b36973ceb52bfc95591bc91d4ac778a4e11d11723f6d8bf208811b8fa7d072851cfed73407c9413455de717e9a42f8e6bb1a133cb2b1981c66bb5832
-
SSDEEP
12288:U5PlaOdmbSUHsuijq4BxhK4Y/OfY6QyMDEh:U597q4Q/OfYUMEh
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2456 wrote to memory of 4188 2456 rundll32.exe 82 PID 2456 wrote to memory of 4188 2456 rundll32.exe 82 PID 2456 wrote to memory of 4188 2456 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\libsodium.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager\libsodium.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:4188
-